This tool helps to manage acls on kafka.
Option                                   Description
------                                   -----------
--add                                    Indicates you are trying to add ACLs.
--allow-host <String: allow-host>        Host from which principals listed in --
                                           allow-principal will have access. If
                                           you have specified --allow-principal
                                           then the default for this option
                                           will be set to '*' which allows
                                           access from all hosts.
--allow-principal <String: allow-        principal is in principalType:name
  principal>                               format. Note that principalType must
                                           be supported by the Authorizer being
                                           used. For example, User:'*' is the
                                           wild card indicating all users.
--bootstrap-controller <String:          A list of host/port pairs to use for
  controller to connect to>                establishing the connection to the
                                           Kafka cluster. This list should be
                                           in the form host1:port1,host2:
                                           port2,... This config is required
                                           for acl management using admin
                                           client API.
--bootstrap-server <String: server to    A list of host/port pairs to use for
  connect to>                              establishing the connection to the
                                           Kafka cluster. This list should be
                                           in the form host1:port1,host2:
                                           port2,... This config is required
                                           for acl management using admin
                                           client API.
--cluster                                Add/Remove cluster ACLs.
--command-config [String: command-       A property file containing configs to
  config]                                  be passed to Admin Client.
--consumer                               Convenience option to add/remove ACLs
                                           for consumer role. This will
                                           generate ACLs that allows READ,
                                           DESCRIBE on topic and READ on group.
--delegation-token <String: delegation-  Delegation token to which ACLs should
  token>                                   be added or removed. A value of '*'
                                           indicates ACL should apply to all
                                           tokens.
--deny-host <String: deny-host>          Host from which principals listed in --
                                           deny-principal will be denied
                                           access. If you have specified --deny-
                                           principal then the default for this
                                           option will be set to '*' which
                                           denies access from all hosts.
--deny-principal <String: deny-          principal is in principalType:name
  principal>                               format. By default anyone not added
                                           through --allow-principal is denied
                                           access. You only need to use this
                                           option as negation to already
                                           allowed set. Note that principalType
                                           must be supported by the Authorizer
                                           being used. For example if you
                                           wanted to allow access to all users
                                           in the system but not test-user you
                                           can define an ACL that allows access
                                           to User:'*' and specify --deny-
                                           principal=User:test@EXAMPLE.COM. AND
                                           PLEASE REMEMBER DENY RULES TAKES
                                           PRECEDENCE OVER ALLOW RULES.
--force                                  Assume Yes to all queries and do not
                                           prompt.
--group <String: group>                  Consumer Group to which the ACLs
                                           should be added or removed. A value
                                           of '*' indicates the ACLs should
                                           apply to all groups.
--help                                   Print usage information.
--idempotent                             Enable idempotence for the producer.
                                           This should be used in combination
                                           with the --producer option. Note
                                           that idempotence is enabled
                                           automatically if the producer is
                                           authorized to a particular
                                           transactional-id.
--list                                   List ACLs for the specified resource,
                                           use --topic <topic> or --group
                                           <group> or --cluster to specify a
                                           resource.
--operation <String>                     Operation that is being allowed or
                                           denied. Valid operation names are:
                                         	Write
                                         	Alter
                                         	DescribeConfigs
                                         	Describe
                                         	ClusterAction
                                         	Read
                                         	DescribeTokens
                                         	All
                                         	IdempotentWrite
                                         	TwoPhaseCommit
                                         	CreateTokens
                                         	Create
                                         	AlterConfigs
                                         	Delete
                                          (default: All)
--principal [String: principal]          List ACLs for the specified principal.
                                           principal is in principalType:name
                                           format. Note that principalType must
                                           be supported by the Authorizer being
                                           used. Multiple --principal option
                                           can be passed.
--producer                               Convenience option to add/remove ACLs
                                           for producer role. This will
                                           generate ACLs that allows WRITE,
                                           DESCRIBE and CREATE on topic.
--remove                                 Indicates you are trying to remove
                                           ACLs.
--resource-pattern-type                  The type of the resource pattern or
  <ANY|MATCH|LITERAL|PREFIXED>             pattern filter. When adding acls,
                                           this should be a specific pattern
                                           type, e.g. 'literal' or 'prefixed'.
                                           When listing or removing acls, a
                                           specific pattern type can be used to
                                           list or remove acls from specific
                                           resource patterns, or use the filter
                                           values of 'any' or 'match', where
                                           'any' will match any pattern type,
                                           but will match the resource name
                                           exactly, where as 'match' will
                                           perform pattern matching to list or
                                           remove all acls that affect the
                                           supplied resource(s). WARNING:
                                           'match', when used in combination
                                           with the '--remove' switch, should
                                           be used with care. (default: LITERAL)
--topic <String: topic>                  topic to which ACLs should be added or
                                           removed. A value of '*' indicates
                                           ACL should apply to all topics.
--transactional-id <String:              The transactionalId to which ACLs
  transactional-id>                        should be added or removed. A value
                                           of '*' indicates the ACLs should
                                           apply to all transactionalIds.
--user-principal <String: user-          Specifies a user principal as a
  principal>                               resource in relation with the
                                           operation. For instance one could
                                           grant CreateTokens or DescribeTokens
                                           permission on a given user principal.
--version                                Display Kafka version.